REST /images/create doesn't work with password, but works using Docker login manually #41570
Description
Description
I have a strange problem. I'm able to authenticate against my ACR (Azure Container Registry) with two different passwords that I've setup when I use "docker login -u <username> -p <password> <serverAddress>" and pull an image.
But, when I use the API "/images/create" found at docs.docker.com/engine/api/v1.40/#operation/ImageCreate
it works with one of the password but not the other.
How can both passwords work with pulling docker manually, but one work and the other not with the above API? I'm using the exact same C# code to create the base64url encoded JSON as specified here: docs.docker.com/engine/api/v1.40/#section/Authentication
and calling post with the X-Registry-Auth header.
To make the situation even weirder, I used the /auth API found here: https://docs.docker.com/engine/api/v1.40/#operation/SystemAuth
and both passwords worked (I got a status HTTP 200).
I can repro this consistently.
The error from dockerd for the BAD password is:
Handler for POST /v1.40/images/create returned error: Get https://<ACR_ADDRESS>/v2/<ImageName>/manifests/v1: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information.
Describe the results you received:
- Received StatusCode=InternalServerError, reasonPhrase=Internal Server Error, header=Api-Version: 1.40
Docker-Experimental: false
Ostype: windows
Server: Docker/19.03.12 (windows)
Date: Mon, 19 Oct 2020 19:48:02 GMT
Connection: close
For the password that does NOT work. For the password that works, got 200 OK.
Describe the results you expected:
- Expect both passwords to work since they both work with docker login. Or both passwords to fail.
Output of docker version:
PS C:\zip> docker version
Client: Docker Engine - Enterprise
Version: 19.03.12
API version: 1.40
Go version: go1.13.13
Git commit: 4306744
Built: 08/05/2020 19:27:53
OS/Arch: windows/amd64
Experimental: false
Server: Docker Engine - Enterprise
Engine:
Version: 19.03.12
API version: 1.40 (minimum version 1.24)
Go version: go1.13.13
Git commit: f295753ffd
Built: 08/05/2020 19:26:41
OS/Arch: windows/amd64
Experimental: false
Output of docker info:
Client:
Debug Mode: false
Plugins:
cluster: Manage Docker Enterprise clusters (Mirantis Inc., v1.6.0)
Server:
Containers: 0
Running: 0
Paused: 0
Stopped: 0
Images: 0
Server Version: 19.03.12
Storage Driver: windowsfilter
Windows:
Logging Driver: json-file
Plugins:
Volume: local
Network: ics internal l2bridge l2tunnel nat null overlay private transparent
Log: awslogs etwlogs fluentd gcplogs gelf json-file local logentries splunk syslog
Swarm: inactive
Default Isolation: process
Kernel Version: 10.0 19041 (19041.1.amd64fre.vb_release.191206-1406)
Operating System: Windows Server 2019 Datacenter Version 2004 (OS Build 19041.1)
OSType: windows
Architecture: x86_64
CPUs: 4
Total Memory: 15.62GiB
Name: WIN-24673IDG8TJ
ID: KOJ2:R27W:RLNB:R2TE:MVSA:YPJZ:X3Z3:GKVB:FF3Q:TEHV:I5CM:CI6A
Docker Root Dir: C:\ProgramData\docker
Debug Mode: true
File Descriptors: -1
Goroutines: 26
System Time: 2020-10-19T16:40:42.3484175-07:00
EventsListeners: 1
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false
Additional environment details (AWS, VirtualBox, physical, etc.):
The images I'm trying to pull and authenticate is with Azure Container Registry.